MGASA-2026-0581

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0581.html
Import Source
https://advisories.mageia.org/MGASA-2026-0581.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0581
Upstream
CVE (6)
Published
2026-11-09T16:32:57Z
Modified
2026-11-09T16:58:23Z
Summary
Updated glibc package fixes security vulnerabilities
Details

Passing an effectively empty string to the ,ccs= syntax extension of the mode argument in the fopen function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for ccs should not pass them through without validation. (CVE-2026-18374) Stack overflow in nscd due to unbounded alloca use. (CVE-2026-89092) Assertion failure in the DNS stub resolver with a long search domain. (CVE-2026-8674) AT_SECURE programs may load attacker-controlled code via $ORIGIN. (CVE-2026-86805) AT_SECURE program buffer overflow via $ORIGIN processing. (CVE-2026-95818) Directory traversal via the LANGUAGE environment variable. (CVE-2026-84243)

References
Credits

Affected packages

Mageia:10 / glibc

Package

Name
glibc
Purl
pkg:rpm/mageia/glibc?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.42-11.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0581.json"